Privacy Policy

1. Introduction

ConformityAI, Inc. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. By using ConformityAI, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address, name, company name, and password (hashed and encrypted). This information is necessary to provide you with access to our service.

2.2 Documents and Content

You may upload documents, policies, and other content to build your knowledge base. This content is stored securely in encrypted databases and is only accessible to you and authorized team members within your organization.

2.3 Usage Data

We collect information about how you interact with our service, including queries made, features used, and time spent. This helps us improve our service and provide better support.

2.4 Technical Data

We automatically collect certain technical information, including IP address, browser type, device information, and cookies. This data is used for security, analytics, and service optimization.

3. How We Use Your Information

• To provide, maintain, and improve our service
• To process your queries and generate AI-powered responses
• To communicate with you about your account, support requests, and service updates
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations and enforce our terms of service
• To analyze usage patterns and improve user experience

Important: We do NOT use your uploaded documents or content to train our AI models. Your data is processed in ephemeral containers and is never used for model training purposes.

4. Data Storage and Security

We implement industry-standard security measures to protect your data:

• All data is encrypted at rest using AES-256 encryption
• Data in transit is protected using TLS 1.3
• Documents are stored in secure, encrypted databases with access controls
• Regular security audits and penetration testing
• Role-based access control (RBAC) to limit data access

5. Data Retention and Deletion

We retain your data only for as long as necessary to provide our service. You may request deletion of your account and all associated data at any time by contacting stacksavvy001@gmail.com. Upon deletion:

• All uploaded documents and content will be permanently deleted
• Vector embeddings will be removed from our databases
• Account information will be anonymized or deleted
• Deletion is completed within 30 days of your request

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share data only in the following circumstances:

• Service Providers: We may share data with trusted third-party service providers (e.g., cloud hosting, payment processing) who assist in operating our service, subject to strict confidentiality agreements.
• Legal Requirements: We may disclose data if required by law, court order, or government regulation.
• Business Transfers: In the event of a merger, acquisition, or sale, your data may be transferred as part of the transaction, with prior notice.

7. Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing of your data for certain purposes
• Restriction: Request restriction of processing in certain circumstances

To exercise these rights, contact us at stacksavvy001@gmail.com.

8. International Data Transfers

Your data may be processed and stored in servers located outside your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and compliance with applicable data protection laws. Enterprise customers can choose specific data residency regions (US, EU, APAC).

9. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice on our website. Your continued use of the service after such changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: